Static task
static1
Behavioral task
behavioral1
Sample
d3f039ab8313b9b5496a20c73222770cee52192a59a9675038e2ca6fa7709cbd.exe
Resource
win7-20230220-en
Behavioral task
behavioral2
Sample
d3f039ab8313b9b5496a20c73222770cee52192a59a9675038e2ca6fa7709cbd.exe
Resource
win10v2004-20230221-en
General
-
Target
d3f039ab8313b9b5496a20c73222770cee52192a59a9675038e2ca6fa7709cbd.zip
-
Size
511KB
-
MD5
ee6f9d60a81a941ed436bfa7483464fd
-
SHA1
81e92ac3042c88d519f58e7092625ad3e792382b
-
SHA256
94cd893c90f16bf5b93a035ec9547d197a3f0c973fb3d399aa55ca52dac9aec4
-
SHA512
504f0d38012dec4515d506a527d53ecc2fbbf32f59174b416c37cb1a9ffeee355d02c80440befe14a7f3b99572531437769a14310cde09b981ad0b5a68a947aa
-
SSDEEP
12288:AscCiG0WI5bQrol7GsXPNhk7QQ99qAmMq7xYN/j6Blf:AscZfWINmol7Jfvk7QWqdb2j6Blf
Malware Config
Signatures
Files
-
d3f039ab8313b9b5496a20c73222770cee52192a59a9675038e2ca6fa7709cbd.zip.zip
Password: infected
-
d3f039ab8313b9b5496a20c73222770cee52192a59a9675038e2ca6fa7709cbd.exe.exe windows
Password: infected
38ea6f39f66a13952d0df81911d291fa
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
DeleteFileA
GetFileSize
WriteFile
WideCharToMultiByte
ReadFile
CreateFileW
MultiByteToWideChar
CloseHandle
OpenProcess
TerminateProcess
Process32FirstW
Process32NextW
CreateToolhelp32Snapshot
GetFullPathNameW
GetFullPathNameA
HeapReAlloc
CreateFileA
CreateMutexW
HeapCompact
SetFilePointer
TryEnterCriticalSection
MapViewOfFile
UnmapViewOfFile
SetEndOfFile
FreeLibrary
HeapAlloc
SystemTimeToFileTime
QueryPerformanceCounter
HeapFree
WaitForSingleObject
InterlockedCompareExchange
UnlockFile
FlushViewOfFile
LockFile
WaitForSingleObjectEx
OutputDebugStringW
GetTickCount
UnlockFileEx
GetProcessHeap
GetSystemTimeAsFileTime
FormatMessageA
InitializeCriticalSection
LoadLibraryW
lstrcpyW
FormatMessageW
GetVersionExW
HeapDestroy
LeaveCriticalSection
RemoveDirectoryA
HeapCreate
HeapValidate
FlushFileBuffers
GetTempPathW
GetLastError
GetProcAddress
HeapSize
LockFileEx
EnterCriticalSection
GetDiskFreeSpaceW
LoadLibraryA
CreateFileMappingA
CreateFileMappingW
GetDiskFreeSpaceA
GetSystemInfo
GetFileAttributesExW
DeleteCriticalSection
GetCurrentThreadId
OutputDebugStringA
GetVersionExA
GetTempPathA
LocalFree
GetSystemTime
AreFileApisANSI
GetCurrentProcess
IsWow64Process
GlobalAlloc
GlobalFree
FileTimeToSystemTime
GetLocalTime
GetFileInformationByHandle
WriteConsoleW
SetEnvironmentVariableW
SetStdHandle
SetEnvironmentVariableA
CompareStringW
GetCurrentProcessId
DeleteFileW
FindNextFileW
lstrcatW
GetModuleFileNameA
LocalAlloc
FindClose
Sleep
CopyFileA
SetCurrentDirectoryA
CreateDirectoryA
lstrcmpW
GetFileAttributesW
lstrlenA
GetStringTypeW
IsValidLocale
EnumSystemLocalesA
GetLocaleInfoA
GetUserDefaultLCID
GetLocaleInfoW
IsValidCodePage
GetOEMCP
GetACP
GetConsoleMode
GetFileAttributesA
FindFirstFileW
GetConsoleCP
GetEnvironmentStringsW
FreeEnvironmentStringsW
GetModuleFileNameW
ExitProcess
GetFileType
GetStdHandle
SetHandleCount
InitializeCriticalSectionAndSpinCount
SetLastError
GetModuleHandleW
TlsFree
InterlockedIncrement
InterlockedDecrement
EncodePointer
DecodePointer
InterlockedExchange
ExitThread
CreateThread
GetCommandLineA
HeapSetInformation
GetStartupInfoW
RaiseException
RtlUnwind
LCMapStringW
GetCPInfo
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
IsProcessorFeaturePresent
GetTimeZoneInformation
TlsAlloc
TlsGetValue
TlsSetValue
user32
CharToOemW
GetDesktopWindow
EnumDisplayDevicesW
ReleaseDC
gdi32
StretchBlt
GetDIBits
CreateDCW
SelectObject
CreateCompatibleDC
CreateCompatibleBitmap
GetObjectW
GetDeviceCaps
advapi32
GetUserNameW
RegCloseKey
RegOpenKeyExW
RegQueryValueExW
shell32
ShellExecuteA
ShellExecuteW
ole32
CoUninitialize
CoCreateInstance
psapi
GetModuleFileNameExW
EnumProcessModules
GetModuleBaseNameW
crypt32
CryptUnprotectData
wininet
HttpAddRequestHeadersW
HttpQueryInfoW
HttpOpenRequestW
InternetOpenW
HttpSendRequestW
InternetOpenUrlW
InternetSetFilePointer
InternetCloseHandle
InternetReadFile
InternetConnectW
InternetSetOptionW
shlwapi
PathMatchSpecW
Sections
.text Size: 719KB - Virtual size: 719KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 72KB - Virtual size: 72KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 10KB - Virtual size: 19KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 60KB - Virtual size: 60KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 27KB - Virtual size: 26KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ